Cyber Security Assessment Netherlands 2026: what does it mean for your website?

On 6 November 2026, the Dutch National Coordinator for Security and Counterterrorism (NCTV) published the Cyber Security Assessment Netherlands 2026 (Cybersecuritybeeld Nederland, CSBN). The annual report describes how the digital threat is developing. This year’s conclusion is a stark one: AI is making the threat faster, deeper and broader, while many organisations’ resilience is lagging behind.

The report is about national security, but several of its findings relate directly to something you use every day: your website. In this article we set out the key points, without jargon. At the end you’ll find five questions to ask your website partner.

From months to hours: vulnerabilities are exploited at lightning speed

Websites run on software: a CMS such as WordPress, plus plugins for forms, cookie notices or newsletters. Vulnerabilities are regularly discovered in that software. Until recently, there was time to respond.

That time is over. According to the CSBN 2026, it still took a few months in 2024 before a known vulnerability was exploited. In 2025 that was a few weeks, and in 2026 a few hours. The cause is AI: attackers use it to find vulnerabilities and write attack code faster.

The Dutch National Cyber Security Centre (NCSC) therefore concludes that a delay of days or weeks no longer fits today’s threat landscape. For your website, that means an update installed ‘sometime next week’ may already be too late. We saw this only last month with the PHP vulnerability of October.

Why your website is an attractive target

Many organisations think: we’re too small, there’s nothing to gain from us. The CSBN shows that reasoning doesn’t hold. Attacks are largely automated. Scripts scan the entire internet for websites with a known vulnerability, regardless of who owns them.

Three findings from the report stand out:

• Breaking in has become logging in. Attackers increasingly use stolen login details rather than technical tricks. Two-factor authentication makes that much harder, yet only 56% of micro-businesses use it.
• Websites as a stage. In November 2025, the websites of around 30 Dutch organisations, including hospitals and Arriva, were defaced with extremist slogans. For a marketing department, that is direct reputational damage.
• Much of the damage stays hidden for a long time. A third of organisations have no or hardly any detection. A breach then only comes to light once the damage has been done.

SMEs also lag behind on preparation. Only 26% have a formal plan for when things go wrong. And of the 78% that use AI, just 9% have made agreements about it.

The supplier shares responsibility

One striking message in the report: small organisations cannot raise their digital resilience on their own. The NCTV therefore explicitly calls suppliers jointly responsible. A chain is only as strong as its weakest link.

That makes sense. As a marketing or communications professional, you’re responsible for the content and results of your website, not for patching a vulnerability at two in the morning. That belongs with your website partner. The question is: do you know how that partner handles it?

Five questions for your website partner

Use these questions as a quick check. If your partner can answer them without hesitation, you’re probably in good hands.

1. How quickly are critical vulnerabilities fixed? Ask for a concrete timeframe, not ‘as soon as possible’.
2. Is a vulnerability shielded before the update is available? With what’s called virtual patching, a known vulnerability can be blocked within hours, even if the plugin maker has no fix yet.
3. Is two-factor authentication mandatory for everyone who can log in? Including former colleagues and agencies that were once given access; those accounts should have been removed.
4. Do you get insight into security? For example, a regular report in plain language that you can forward to your management.
5. What happens during an incident? Who calls whom, what do you tell customers, and how do you handle the 72-hour reporting obligation for a data breach?

What we’re doing about it

At SowiesoDigital, we manage the websites of more than fifty clients. The CSBN confirms the course we had already set, and we are tightening it further:

• Known vulnerabilities in plugins will now be shielded immediately, even before the update is available.
• Updates are rolled out in fixed, tested rounds: first on a test environment, then live.
• Critical vulnerabilities are handled with priority.

We will be informing our clients about this personally shortly.

Book a meeting.

Frequently asked questions

What is the Cyber Security Assessment Netherlands?

The Cyber Security Assessment Netherlands (CSBN) is an annual report by the NCTV on digital threats, interests and resilience in relation to national security. The 2026 edition was published on 6 November 2026.

Is my website really a target if we’re a small organisation?

Yes. Most attacks are automated and look for known vulnerabilities, not for specific organisations. A small site with an outdated plugin is just as easy to find as a large one.

What is virtual patching?

Virtual patching shields a known vulnerability with a security rule, without the software itself having been updated yet. This protects a website in the period between a vulnerability becoming known and the actual update being installed.

What should I do if I think my website has been hacked?

Contact your website partner immediately and don’t change any settings yourself, so that traces are preserved. Could personal data have been leaked, for example from a contact form? Then your organisation may be required to report this to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours.

Source: NCTV, Cyber Security Assessment Netherlands 2026